Run a test¶

Stealth Prompt tests one interaction that you explicitly bind. It does not crawl the site or select a scope on your behalf.

Configure the assessment¶

1. Choose a provider and model.
2. Choose a behavior and security objective.
3. Choose how replies are captured.
4. Set data sharing and automatic-run limits.

The two Auto controls are independent:

• Auto behavior authorizes the bounded send/capture/analyze loop described below.
• Auto — let AI choose is an objective option. It first maps visible capabilities, selects one concrete security objective supported by evidence, and keeps that focus until the evidence warrants a pivot. It does not grant permission to send anything.

Choose a named objective when you already know the boundary you need to test. Choose the Auto objective when the target's capabilities or most relevant weakness are not clear yet.

Behaviors¶

Auto defaults to 20 turns with unlimited time. Turns can be limited to 1–100 or set to Unlimited. Unlimited turns require Pause or Stop when a potential finding appears, so an unattended run cannot continue forever without a finding policy.

Bind the interaction¶

Open the target page and click the extension toolbar icon. Select Use current tab, then start with Detect elements. The detector proposes each role independently:

• Input — the editable chat field;
• Send control — the control associated with that input;
• Response container — the assistant output to capture.

Review each suggestion and save the interaction. Use Highlight to locate a match or Pick manually when detection is wrong. A manual pick is already an operator choice and does not require a second acceptance step.

The extension adds private markers to the selected DOM elements for stable execution inside the current document. It does not change the page's application identifiers. After navigation or a re-render, validation either resolves the reviewed locator again or pauses instead of acting on an ambiguous element.

When response capture is unreliable¶

Choose Paste response for canvas output, virtualized conversations, inaccessible frames, or a response container that cannot be identified reliably. Only input and send control are required; paste the latest assistant reply before generating the next turn.

Page capture shows a 15-second countdown. If it expires, Check page again watches the same post-send snapshot for another 15 seconds without resending the payload. You can instead paste the reply into the recovery field or choose Re-detect response, which runs read-only detection and opens Interaction for review. Pasted text preserves the session and is recorded as operator-provided evidence. If a completed Assist or Guided turn captured the wrong text, choose Paste bot response beside Generate payload and supply the latest reply without restarting. The extension rejects page-level response containers that also contain the selected input or Send control.

Verify before sending¶

Fill harmless test draft writes a benign draft to the selected input and never presses Send. Use it to verify the binding without contacting the target agent.

Findings during Auto¶

Choose one policy before starting:

• Pause for operator verification;
• Stop and save the finding;
• Continue while recording the signal in the final report.

Potential does not mean confirmed. Confirmation requires a deterministic scorer or an explicit operator decision. You can confirm and continue when you want to preserve the evidence and explore the chain further.

Compare framing variants¶

For indirect prompt injection, instruction disclosure, and sensitive-data disclosure, Behavior also offers Compare framing variants (FrameFuzz). It replaces adaptive payload generation with a closed, deterministic matched experiment. Clean control and explicit cases are always included; select at least one framed case.

Every case stops at a fresh-context gate. Open a new target conversation, confirm the reset, and let Stealth Prompt revalidate the origin and interaction binding. Auto authorization applies to one case only and is revoked at the next boundary. See the FrameFuzz method, conclusions, and safe demo. Choosing an objective outside those three automatically turns FrameFuzz off, so a stale experiment setting cannot block an unrelated assessment.

Continue a useful line of investigation¶

The planner receives the bounded conversation history, current objective, tactic, hypothesis, prior signals, and attempted approaches. It should advance or change the test strategy, not merely answer the target's last sentence. At a turn limit, use the continuation action to grant another bounded block without discarding the session.

For the complete behavior, persistence, protocol, and binding reference, see the browser extension guide.